Event ID 2026 — Shared Folders (SMB) Server Service Availability

Applies To: Windows Server 2008

The Server Message Block (SMB) protocol is what Windows uses to share files, printers, serial ports, and communicate this information between computers. The service must be running for the server to identify and share resources.

Event Details

Product: Windows Operating System
ID: 2026
Source: Server
Version: 6.0
Symbolic Name: EVENT_SRV_TOO_MANY_DOS
Message: The server has detected too many Denial-Of-Service attacks and will stop logging events for any more of them. Be advised it is likely someone is actively attacking your machine.

Resolve

Security Alert - Review client or network usage

Denial of service (DoS) attacks are network attacks that are aimed at making a computer or a particular service on a computer unavailable to network users. It is important that you determine if the server is experiencing a DoS attack. For more information to help you understand network security and DoS attacks, see the Microsoft Security Central website at https://www.microsoft.com/security.

Verify

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To verify the Shared Folder (SMB) server is available:

  1. Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. Type net config server.
  3. Verify that NetbiosSmb appears under the Server is active on section in the results.

Shared Folders (SMB) Server Service Availability

File Services